All of lore.kernel.org
 help / color / mirror / Atom feed
From: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
To: leonro@nvidia.com, jgg@nvidia.com
Cc: linux-rdma@vger.kernel.org, Zheyu Ma <zheyuma97@gmail.com>,
	Douglas Miller <doug.miller@cornelisnetworks.com>
Subject: [PATCH for-next 1/6] RDMA/hfi1: Prevent use of lock before it is initialized
Date: Fri, 20 May 2022 14:37:01 -0400	[thread overview]
Message-ID: <20220520183701.48973.72434.stgit@awfm-01.cornelisnetworks.com> (raw)
In-Reply-To: <20220520183516.48973.565.stgit@awfm-01.cornelisnetworks.com>

From: Douglas Miller <doug.miller@cornelisnetworks.com>

If there is a failure during probe of hfi1 before the sdma_map_lock is
initialized, the call to hfi1_free_devdata() will attempt to use a lock
that has not been initialized. If the locking correctness validator is on
then an INFO message and stack trace resembling the following may be seen:

INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
Call Trace:
register_lock_class+0x11b/0x880
__lock_acquire+0xf3/0x7930
lock_acquire+0xff/0x2d0
_raw_spin_lock_irq+0x46/0x60
sdma_clean+0x42a/0x660 [hfi1]
hfi1_free_devdata+0x3a7/0x420 [hfi1]
init_one+0x867/0x11a0 [hfi1]
pci_device_probe+0x40e/0x8d0

The use of sdma_map_lock in sdma_clean() is for freeing the sdma_map
memory, and sdma_map is not allocated/initialized until after
sdma_map_lock has been initialized. This code only needs to be run if
sdma_map is not NULL, and so checking for that condition will avoid
trying to use the lock before it is initialized.

Fixes: 473291b3ea0e1 ("IB/hfi1: Fix for early release of sdma context")
Fixes: 7724105686e71 ("IB/hfi1: add driver files")

Reported-by: Zheyu Ma <zheyuma97@gmail.com>
Signed-off-by: Douglas Miller <doug.miller@cornelisnetworks.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
---
 drivers/infiniband/hw/hfi1/sdma.c |   12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c
index f07d328..a95b654 100644
--- a/drivers/infiniband/hw/hfi1/sdma.c
+++ b/drivers/infiniband/hw/hfi1/sdma.c
@@ -1288,11 +1288,13 @@ void sdma_clean(struct hfi1_devdata *dd, size_t num_engines)
 		kvfree(sde->tx_ring);
 		sde->tx_ring = NULL;
 	}
-	spin_lock_irq(&dd->sde_map_lock);
-	sdma_map_free(rcu_access_pointer(dd->sdma_map));
-	RCU_INIT_POINTER(dd->sdma_map, NULL);
-	spin_unlock_irq(&dd->sde_map_lock);
-	synchronize_rcu();
+	if (rcu_access_pointer(dd->sdma_map)) {
+		spin_lock_irq(&dd->sde_map_lock);
+		sdma_map_free(rcu_access_pointer(dd->sdma_map));
+		RCU_INIT_POINTER(dd->sdma_map, NULL);
+		spin_unlock_irq(&dd->sde_map_lock);
+		synchronize_rcu();
+	}
 	kfree(dd->per_sdma);
 	dd->per_sdma = NULL;
 


  reply	other threads:[~2022-05-20 18:37 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-20 18:36 [PATCH for-next 0/6] Updates for 5.19 Dennis Dalessandro
2022-05-20 18:37 ` Dennis Dalessandro [this message]
2022-05-20 18:37 ` [PATCH for-next 2/6] RDMA/hfi1: Prevent panic when SDMA is disabled Dennis Dalessandro
2022-05-20 18:37 ` [PATCH for-next 3/6] RDMA/hfi1: Fix potential integer multiplication overflow errors Dennis Dalessandro
2022-05-20 18:37 ` [PATCH for-next 4/6] RDMA/hfi1: Remove pointless driver version Dennis Dalessandro
2022-05-20 18:37 ` [PATCH for-next 5/6] RDMA/hfi1: Consolidate software versions Dennis Dalessandro
2022-05-20 18:37 ` [PATCH for-next 6/6] RDMA/hfi1: Remove all traces of diagpkt support Dennis Dalessandro
2022-05-24 18:43 ` [PATCH for-next 0/6] Updates for 5.19 Jason Gunthorpe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20220520183701.48973.72434.stgit@awfm-01.cornelisnetworks.com \
    --to=dennis.dalessandro@cornelisnetworks.com \
    --cc=doug.miller@cornelisnetworks.com \
    --cc=jgg@nvidia.com \
    --cc=leonro@nvidia.com \
    --cc=linux-rdma@vger.kernel.org \
    --cc=zheyuma97@gmail.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.